Dead#Vax Self-Parsing PowerShell Loader

Luke Kuenning@MtnMarathoner

•updated Mar 10, 2026•0•54

Detects PowerShell attempting to read a specific batch file named 'rEgX.cmd' using Get-Content, a signature behavior of the Dead#Vax self-parsing loader. This technique is used to extract a hidden payload from the script itself.